Skip to main content

​
Concepts

​
Agents on endpoints

An agent is an AI coding tool such as Claude Code, Codex, or Claude Cowork. It runs on an endpoint, a computer with Kontext installed. Home lists your endpoints and the agents Kontext found on each.

​
Tool calls

A tool call is an agent’s request to run a shell command, edit a file, or use an MCP tool. Kontext checks each tool call on the endpoint before it runs and records the result.

​
Policies

A policy decides Allow or Deny for a tool call. A policy in the Observing list shows what it would block without blocking calls. A policy in the Enforced list blocks matching calls.

​
Risk and cost

Risk flags tool calls for review. Cost prices the model requests behind those calls. Neither changes a decision.

​
Example

Your workspace enforces no policies yet and has Block GitHub force pushes in the Observing list. A developer asks Claude Code to clean up a branch. The agent tries to run git push --force. Kontext evaluates the push on the developer’s endpoint and records a Deny. The endpoint lets the push run. Explore shows “Would deny: but the call ran.” Risk may flag the push and explain its potential effects. After a week, the policy has matched only force pushes. You click Enforce. The endpoint denies the next force push before it runs. Explore shows “Denied: the call was blocked.” The reason reads “Blocked by rule block-github-force-push”.

​
Next steps

  • Object model shows how endpoints, agents, sessions, tool calls, and policies relate.
  • How decisions work follows one tool call from the hook to the dashboard.